fix: make Linux installation permissions deterministic

scripts/test-install-fixture.sh

@@ -10,6 +10,10 @@ fail() {
   exit 1
 }
 
+mode_of() {
+  stat -c '%a' "$1" 2>/dev/null || stat -f '%Lp' "$1"
+}
+
 # Load only pure helper functions. The installer itself must never run in this fixture.
 {
   sed -n '/^decode_env_value()/,/^}/p' "$ROOT/deploy/install.sh"
@@ -22,7 +26,9 @@ fail() {
   sed -n '/^configure_app_port()/,/^}/p' "$ROOT/deploy/install.sh"
   sed -n '/^is_semver()/,/^}/p' "$ROOT/deploy/install.sh"
   sed -n '/^write_env_file_preserving_unknown()/,/^}/p' "$ROOT/deploy/install.sh"
+  sed -n '/^normalized_host_arch()/,/^}/p' "$ROOT/deploy/install.sh"
   sed -n '/^azul_arch()/,/^}/p' "$ROOT/deploy/install.sh"
+  sed -n '/^java_arch_matches_host()/,/^}/p' "$ROOT/deploy/install.sh"
   sed -n '/^system_java_home()/,/^}/p' "$ROOT/deploy/install.sh"
   sed -n '/^sha256_file()/,/^}/p' "$ROOT/deploy/install.sh"
   sed -n '/^prepare_java()/,/^}/p' "$ROOT/deploy/install.sh"
@@ -31,6 +37,8 @@ fail() {
   sed -n '/^download_release_asset()/,/^}/p' "$ROOT/deploy/install.sh"
   sed -n '/^install_packages()/,/^}/p' "$ROOT/deploy/install.sh"
   sed -n '/^preflight_database()/,/^}/p' "$ROOT/deploy/install.sh"
+  sed -n '/^secure_release_tree()/,/^}/p' "$ROOT/deploy/install.sh"
+  sed -n '/^restore_unit_state()/,/^}/p' "$ROOT/deploy/install.sh"
 } > "$WORK/helpers.sh"
 # shellcheck disable=SC1090,SC1091
 source "$WORK/helpers.sh"
@@ -38,6 +46,35 @@ source "$WORK/helpers.sh"
 export SETUP_WIZARD=true
 preflight_database || fail 'setup wizard database preflight returned a failure status'
 
+release_permissions="$WORK/release-permissions"
+mkdir -p "$release_permissions/public" "$release_permissions/ops"
+printf 'jar\n' > "$release_permissions/app.jar"
+printf 'html\n' > "$release_permissions/public/index.html"
+printf '#!/bin/sh\n' > "$release_permissions/ops/update.sh"
+chmod -R 0777 "$release_permissions"
+(
+  # shellcheck disable=SC2329 # Invoked indirectly by the sourced installer helper.
+  chown() { return 0; }
+  export SERVICE_GROUP=fixture
+  secure_release_tree "$release_permissions"
+)
+[ "$(mode_of "$release_permissions")" = 750 ] || fail 'release root mode is not 0750'
+[ "$(mode_of "$release_permissions/public")" = 750 ] || fail 'release directory mode is not 0750'
+[ "$(mode_of "$release_permissions/app.jar")" = 640 ] || fail 'release file mode is not 0640'
+[ "$(mode_of "$release_permissions/ops/update.sh")" = 750 ] || fail 'release updater mode is not 0750'
+
+(
+  # shellcheck disable=SC2329 # Invoked indirectly by the sourced installer helper.
+  systemctl() {
+    case "$1" in
+      cat) return 1 ;;
+      reset-failed) return 0 ;;
+      *) return 97 ;;
+    esac
+  }
+  restore_unit_state missing.service false false
+) || fail 'rollback treated an absent first-install unit as an incomplete restoration'
+
 # shellcheck disable=SC2034 # Referenced by the extracted installer helper.
 REINSTALL=true
 # shellcheck disable=SC2034 # Referenced by the extracted installer helper.
@@ -137,10 +174,23 @@ for arch in i386 i486 i586 i686; do
   ARCH_FIXTURE=$arch
   [ "$(azul_arch)" = i686 ] || fail "$arch did not map to the Azul i686 runtime"
 done
+(
+  ARCH_FIXTURE=x86_64
+  # shellcheck disable=SC2329 # Invoked indirectly by the sourced architecture helper.
+  getconf() { printf '32\n'; }
+  [ "$(normalized_host_arch)" = x86 ] \
+    || fail '32-bit userspace on an x86_64 kernel was not normalized to x86'
+  export HOST_ARCH=x86
+  [ "$(azul_arch)" = i686 ] \
+    || fail '32-bit userspace on an x86_64 kernel did not select the i686 Java runtime'
+)
 
 mkdir -p "$WORK/fake-jre/bin"
 cat > "$WORK/fake-jre/bin/java" <<'JAVA'
 #!/usr/bin/env sh
+if [ "${1:-}" = '-XshowSettings:properties' ]; then
+  printf '    os.arch = x86\n' >&2
+fi
 printf 'openjdk version "17-fixture"\n' >&2
 JAVA
 chmod 0755 "$WORK/fake-jre/bin/java"
@@ -168,9 +218,10 @@ prepare_java >/dev/null 2>&1
 rm -rf "$JAVA_STAGED_DIR"
 export KAIDI_JAVA_HOME="$WORK/fake-jre"
 prepare_java >/dev/null 2>&1
-[ -L "$JAVA_STAGED_DIR" ] || fail 'existing Java 17 runtime was not reused'
-[ "$(readlink -f "$JAVA_STAGED_DIR")" = "$(readlink -f "$WORK/fake-jre")" ] \
-  || fail 'installer linked an unexpected local Java runtime'
+[ -d "$JAVA_STAGED_DIR" ] && [ ! -L "$JAVA_STAGED_DIR" ] \
+  || fail 'existing Java 17 runtime was not copied into managed storage'
+cmp -s "$WORK/fake-jre/bin/java" "$JAVA_STAGED_DIR/bin/java" \
+  || fail 'installer staged an unexpected local Java runtime'
 
 export RELEASE_API_URL=https://gitea.fixture.invalid/api/v1/repos/ERP-Team/kaidi/releases/latest
 RELEASE_TOKEN=fixture-read-only-token
@@ -237,14 +288,35 @@ grep -Fq 'download "$api" "$java_metadata"' "$ROOT/deploy/install.sh" \
 # shellcheck disable=SC2016 # Match literal installer source.
 grep -Fq 'java_sha256=$(jq -er' "$ROOT/deploy/install.sh" \
   || fail 'installer no longer obtains the Java runtime SHA-256'
-grep -Fq 'Using existing Java 17 runtime' "$ROOT/deploy/install.sh" \
+grep -Fq 'Copying existing Java 17 runtime' "$ROOT/deploy/install.sh" \
   || fail 'installer no longer reuses a local Java 17 runtime'
+# shellcheck disable=SC2016 # Match literal installer source.
+grep -Fq 'cp -R "$system_home/." "$JAVA_STAGED_DIR/"' "$ROOT/deploy/install.sh" \
+  || fail 'installer no longer copies a local Java runtime into managed storage'
+# shellcheck disable=SC2016 # Match literal installer source.
+! grep -Fq 'ln -s "$system_home"' "$ROOT/deploy/install.sh" \
+  || fail 'installer must not link the service to an externally managed Java directory'
 # shellcheck disable=SC2016 # Match the literal installer command.
 grep -Fq -- '--connect-timeout 1 --max-time 2 "$HEALTH_URL" 2>/dev/null' "$ROOT/deploy/install.sh" \
   || fail 'installer no longer performs a quiet bounded health check'
 grep -Fq 'restart_count" -ge 3' "$ROOT/deploy/install.sh" \
   || fail 'installer no longer stops early after repeated service restarts'
 # shellcheck disable=SC2016 # Match literal installer source.
+grep -Fq 'install -d -o root -g "$SERVICE_GROUP" -m 0750' "$ROOT/deploy/install.sh" \
+  || fail 'installer no longer creates traversable root-owned application directories'
+# shellcheck disable=SC2016 # Match literal installer source.
+grep -Fq 'find "$release_dir" -type d -exec chmod 0750 {} +' "$ROOT/deploy/install.sh" \
+  || fail 'installer no longer secures release directory traversal permissions'
+# shellcheck disable=SC2016 # Match literal installer source.
+grep -Fq 'runuser -u "$SERVICE_USER" -- sh -c' "$ROOT/deploy/install.sh" \
+  || fail 'installer no longer validates the release as the service user'
+grep -Fq 'systemctl reset-failed kaidi-finance.service' "$ROOT/deploy/install.sh" \
+  || fail 'installer no longer resets stale systemd failure state'
+[ "$(tail -n 1 "$ROOT/deploy/install.sh")" = 'main "$@"' ] \
+  || fail 'installer can execute before the complete curl stream is parsed'
+grep -Fqx 'StartLimitBurst=3' "$ROOT/deploy/systemd/kaidi-finance.service" \
+  || fail 'application service no longer has a bounded restart burst'
+# shellcheck disable=SC2016 # Match literal installer source.
 grep -Fq '[ "$actual_sha256" = "$java_sha256" ]' "$ROOT/deploy/install.sh" \
   || fail 'installer no longer verifies the Java runtime SHA-256'
 grep -Fq 'https://git.awaioi.com/api/v1/repos/ERP-Team/kaidi/releases/latest' "$ROOT/deploy/install.sh" \
@@ -301,8 +373,8 @@ grep -Fq 'EnvironmentFile=-/var/lib/kaidi/setup/application.env' \
 grep -Fq 'EnvironmentFile=-/var/lib/kaidi/setup/application.env' \
   "$ROOT/deploy/systemd/kaidi-update.service" \
   || fail 'update service no longer loads setup database overrides'
-# shellcheck disable=SC2016 # Match the literal installer source.
-grep -Fq 'chown root:kaidi "$UPDATE_STATE_ROOT"' "$ROOT/deploy/install.sh" \
+# shellcheck disable=SC2016 # Match literal installer source.
+grep -Fq 'install -d -o root -g "$SERVICE_GROUP" -m 0750 "$UPDATE_STATE_ROOT"' "$ROOT/deploy/install.sh" \
   || fail 'update state parent is not group-accessible to the application user'
 grep -Fq 'install.sh | sudo bash' "$ROOT/README.md" \
   || fail 'README does not document the public one-line setup-wizard install path'

scripts/test-update-fixture.sh

@@ -11,6 +11,10 @@ fail() {
   exit 1
 }
 
+mode_of() {
+  stat -c '%a' "$1" 2>/dev/null || stat -f '%Lp' "$1"
+}
+
 sed -n '/^is_semver()/,/^}/p' "$ROOT/deploy/update.sh" > "$WORK/update-semver.sh"
 # shellcheck disable=SC1090,SC1091
 source "$WORK/update-semver.sh"
@@ -21,6 +25,20 @@ for version in 01.2.3 1.02.3 1.2.03 1.2.3-01 1.2.3-alpha..1; do
   ! is_semver "$version" || fail "updater accepted invalid SemVer $version"
 done
 
+missing_service_user="kaidi-fixture-missing-$$"
+if KAIDI_APP_ROOT="$WORK/bootstrap/app" \
+  KAIDI_UPDATE_STATE_ROOT="$WORK/bootstrap/state" \
+  KAIDI_LOG_ROOT="$WORK/bootstrap/log" \
+  KAIDI_SERVICE_USER="$missing_service_user" \
+  KAIDI_SERVICE_GROUP="$missing_service_user" \
+  sh "$ROOT/deploy/update.sh" > "$WORK/bootstrap.log" 2>&1; then
+  fail 'updater accepted a missing service identity during bootstrap'
+fi
+grep -Fq "Service user $missing_service_user is missing" "$WORK/bootstrap.log" \
+  || fail 'updater bootstrap failure did not preserve its diagnostic'
+! grep -Eq 'No such file|nonexistent directory|cannot create' "$WORK/bootstrap.log" \
+  || fail 'updater bootstrap failure was masked by an unavailable status directory'
+
 write_mock_commands() {
   local mock_bin=$1
   mkdir -p "$mock_bin"
@@ -99,6 +117,33 @@ SH
   cat > "$mock_bin/chown" <<'SH'
 #!/bin/sh
 exit 0
+SH
+
+  cat > "$mock_bin/runuser" <<'SH'
+#!/bin/sh
+[ "${1:-}" = -u ] || exit 2
+shift 2
+[ "${1:-}" = -- ] && shift
+exec "$@"
+SH
+
+  cat > "$mock_bin/install" <<'SH'
+#!/usr/bin/env bash
+if [[ " $* " != *" -d "* ]]; then
+  exec /usr/bin/install "$@"
+fi
+mode=0755
+paths=()
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -d) shift ;;
+    -o|-g) shift 2 ;;
+    -m) mode=$2; shift 2 ;;
+    *) paths+=("$1"); shift ;;
+  esac
+done
+mkdir -p "${paths[@]}"
+chmod "$mode" "${paths[@]}"
 SH
 
   cat > "$mock_bin/mv" <<'SH'
@@ -170,13 +215,18 @@ prepare_installation() {
   local fixture=$1
   local version=$2
   mkdir -p "$fixture/app/releases/1.0.0-preview.1/public" "$fixture/app/bin" \
-    "$fixture/state/inbox" "$fixture/systemd" "$fixture/log"
+    "$fixture/app/runtime/java/bin" "$fixture/state/inbox" "$fixture/systemd" "$fixture/log"
   printf 'old application\n' > "$fixture/app/releases/1.0.0-preview.1/app.jar"
   printf '<!doctype html><title>old</title>\n' > "$fixture/app/releases/1.0.0-preview.1/public/index.html"
   printf '1.0.0-preview.1\n' > "$fixture/app/releases/1.0.0-preview.1/VERSION"
   ln -s "$fixture/app/releases/1.0.0-preview.1" "$fixture/app/current"
   printf 'old update.sh\n' > "$fixture/app/bin/update.sh"
   chmod 0755 "$fixture/app/bin/update.sh"
+  cat > "$fixture/app/runtime/java/bin/java" <<'SH'
+#!/bin/sh
+exit 0
+SH
+  chmod 0755 "$fixture/app/runtime/java/bin/java"
   for name in kaidi-finance.service kaidi-update.service kaidi-update.path; do
     printf 'old %s\n' "$name" > "$fixture/systemd/$name"
   done
@@ -222,6 +272,8 @@ run_update() {
     MOCK_RELEASE_ORIGIN="${FIXTURE_RELEASE_ORIGIN:-https://release.fixture.invalid}" \
     MOCK_EXPECT_RELEASE_TOKEN="${FIXTURE_RELEASE_TOKEN-}" \
     MOCK_SYSTEMCTL_LOG="$fixture/systemctl.log" \
+    KAIDI_SERVICE_USER="$(id -un)" \
+    KAIDI_SERVICE_GROUP="$(id -gn)" \
     KAIDI_APP_ROOT="$fixture/app" \
     KAIDI_UPDATE_STATE_ROOT="$fixture/state" \
     KAIDI_LOG_ROOT="$fixture/log" \
@@ -310,6 +362,10 @@ assert_success_case() {
     || fail 'success case left a claimed request behind'
   grep -qx 'daemon-reload' "$fixture/systemctl.log" || fail 'systemd units were not reloaded'
   ! grep -qi nginx "$fixture/systemctl.log" || fail 'updater unexpectedly managed Nginx'
+  [ "$(mode_of "$fixture/app")" = 750 ] || fail 'application root is not traversable by the service group'
+  [ "$(mode_of "$fixture/app/releases/$version")" = 750 ] || fail 'release root mode is not 0750'
+  [ "$(mode_of "$fixture/app/current/app.jar")" = 640 ] || fail 'release file mode is not 0640'
+  [ "$(mode_of "$fixture/app/current/ops/update.sh")" = 750 ] || fail 'release updater mode is not 0750'
 }
 
 assert_rollback_case() {